Adding changes for Fleet v4.68.0 (#28800)
This commit is contained in:
Luke Heath
@@ -1,3 +1,78 @@
|
||||
## Fleet 4.68.0 (May 22, 2025)
|
||||
|
||||
### Security Engineers
|
||||
- Built Fleet integration with Microsoft Entra to conditionally prevent single sign-on for hosts failing policies.
|
||||
- Added ability to set conditional access per policy, and update host policy UI to incorporate conditional access data.
|
||||
- Added CVE ID as matching criteria for host software queries, in addition to software name. Also rebuild host software querying for better maintainability.
|
||||
- Updated Fleet-managed DigiCert, NDES, and SCEP certificates to be renewed 30 days before expiry for those valid longer than 30 days or when half the validity period remains for certificates valid 30 days or less. Applies to certificates requested using this release or later.
|
||||
- Added webhook as a logging configuration option.
|
||||
- Added webhook query automation logging.
|
||||
- Added shell and Powershell syntax highlighting when editing scripts.
|
||||
- Added ability to run a script on a batch of hosts with a single user flow.
|
||||
- Added download validation and existing-installer matching in GitOps via a new `hash_sha256` field in software YAML.
|
||||
- Added `hash_sha256` field to the response for the `GET /software/titles` API.
|
||||
- Added `fleetctl generate-gitops` command to generate gitops YAML files based on current Fleet configuration.
|
||||
- Enabled saving Integrations > Advanced in GitOps mode.
|
||||
|
||||
### IT Admins
|
||||
- Added ability to run a script on a batch of hosts with a single user flow.
|
||||
- Added the ability to upload and install tarball archives (.tar.gz).
|
||||
- Added support for Fleet-maintained apps in GitOps.
|
||||
- Added ability to add FMA via `fleetctl` YAML files.
|
||||
- Added shell and Powershell syntax highlighting when editing scripts.
|
||||
- Added query ID to query automation logs.
|
||||
- Added UI for the manual agent install of a bootstrap package.
|
||||
- Added categorization for self-service software, including filtering on the "My device" page.
|
||||
- Added number of policies triggering automatic install of software in software table.
|
||||
- Added webhook as a logging configuration option.
|
||||
- Added webhook query automation logging.
|
||||
- Added download validation and existing-installer matching in GitOps via a new `hash_sha256` field in software YAML.
|
||||
- Added `hash_sha256` field to the response for the `GET /software/titles` API.
|
||||
- Added support for `FLEET_VAR_HOST_END_USER_IDP_USERNAME`, `FLEET_VAR_HOST_END_USER_IDP_USERNAME_LOCAL_PART` and `FLEET_VAR_HOST_END_USER_IDP_GROUPS` fleet variables in macOS MDM configuration profiles.
|
||||
- Added `last_mdm_enrolled_at` and `last_mdm_checked_in_at` to host detail endpoints to return the last time a host enrolled, or re-enrolled in MDM and the last time a host checked in via MDM, respectively.
|
||||
- Added `fleetctl generate-gitops` command to generate gitops YAML files based on current Fleet configuration.
|
||||
- Updated Fleet-managed DigiCert, NDES, and SCEP certificates to be renewed 30 days before expiry for those valid longer than 30 days or when half the validity period remains for certificates valid 30 days or less. Applies to certificates requested using this release or later.
|
||||
- Updated host certificates with serial numbers below 2^63 will now display the decimal represntation of the serial number in addition to hex so that it is easier to match them up to what is displayed in the macOS keychain.
|
||||
- Updated Install Status to correctly display available for self-service VPP apps.
|
||||
- Logged invalid Windows MDM SOAP message and return 400 instead of 5XX. This change helps debug Windows MDM issues.
|
||||
- Added `macos_setup.manual_agent_install` option in Mac setup experience to bypass fleetd install. Instead, fleetd should be installed via customer-customized bootstrap package.
|
||||
- Allowed uploading VPP apps when GitOps mode is enabled.
|
||||
- Allowed viewing the status details for an (un)install via the "My device" page.
|
||||
- Updated Apple MDM enrollment flow to improve device-to-user mapping.
|
||||
- Updated verification of Windows Wireless profiles to avoid resending already-applied profiles.
|
||||
- Enabled saving Integrations > Advanced in GitOps mode.
|
||||
|
||||
### Other improvements and bug fixes
|
||||
- Added hover cursors to checkbox and radio form elements.
|
||||
- Added keyboard accessibility controls to activities on dashboard and host details pages.
|
||||
- Added an additional statistic item to count ABM pending hosts.
|
||||
- Added truncation and a conditional tooltip for long host names on the host details page.
|
||||
- Updated the parser used when editing SQL in the UI to handle modern expressions like window functions.
|
||||
- Updated "My device" page layout.
|
||||
- Updated Google Calendar event bodies and relevant previews in the Fleet UI.
|
||||
- Updated UI for Settings > Organization settings > Organization info.
|
||||
- Updated LUKS escrow instrucitons.
|
||||
- Updated error message and related documentation for Windows MDM configuration.
|
||||
- Updated UI to show the premium feature message when viewing the GitOps mode toggle page on Fleet free.
|
||||
- Cleaned up various empty and configured states on the settings pages.
|
||||
- Improved performance on database migration from 4.66 and earlier for instances with large macOS host counts.
|
||||
- Removed Apple MDM profile validation checks for com.apple.MCX keys (dontAllowFDEDisable and dontAllowFDEEnable) due to customer feedback.
|
||||
- Removed Fleet config no team settings when the `no-team.yml` file is removed via GitOps.
|
||||
- Updated Go to 1.24.2.
|
||||
- Fixed an issue where the upcoming host activities showed the incorrect created at date in the tooltip.
|
||||
- Fixed bug where Fleet failed to restore some "pending" hosts (i.e. hosts that remained assigned to Fleet in Apple Business Manager) when multiple hosts are deleted from Fleet.
|
||||
- Fixed an issue with how names for macOS software titles were calculated and prevents duplicate entries being created if the software is renamed by end users.
|
||||
- Fixed issue when Apple device was removed/re-added to ABM, it was not getting an enrollment profile.
|
||||
- Fixed issue where `fleetctl gitops --dry-run` would sometimes fail when creating and using labels in the same run.
|
||||
- Fixed a small bug with the way live policy result percentages were being rounded.
|
||||
- Fixed an issue where selections made on the Queries page were cleared a few seconds after page load.
|
||||
- Fixed an issue with the gitops command caused when trying to interpolate variables inside the 'description'/'remediation' sections.
|
||||
- Fixed `fleetctl gitops` issue where creating a new team containing VPP apps caused an error.
|
||||
- Fixed issue where GitOps may fail to apply new queries due to deadlocks.
|
||||
- Fixed spurious install/uninstall script errors on EXE software edits when install and uninstall scripts were specified.
|
||||
- Fixed issue where the host expiry window caused MDM devices assigned to Fleet in Apple Business Manager (ABM) to be repeatedly deleted and re-added to Fleet, which in some cases also caused the device to revert to the default team.
|
||||
- Fixed missing To: email header.
|
||||
|
||||
## Fleet 4.67.3 (May 6, 2025)
|
||||
|
||||
- Removed error caused by macOS electron helper apps during ingestion.
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
- Updated UI for Settings > Organization settings > Organization info.
|
||||
@@ -1 +0,0 @@
|
||||
Added last_mdm_enrolled_at and last_mdm_checked_in_at to host detail endpoints to return the last time a host enrolled, or re-enrolled in MDM and the last time a host checked in via MDM, respectively. This data is only returned for macOS, iOS and iPadOS hosts enrolled in Fleet MDM currently, other platforms will return null.
|
||||
@@ -1 +0,0 @@
|
||||
- Build Fleet integration with Microsoft Entra to conditionally prevent single sign-on for hosts failing policies
|
||||
@@ -1 +0,0 @@
|
||||
- Added download validation and existing-installer matching in GitOps via a new `hash_sha256` field in software YAML.
|
||||
@@ -1,2 +0,0 @@
|
||||
- Fixes an issue with how names for macOS software titles were calculated and prevents duplicate
|
||||
entries being created if the software is renamed by end users.
|
||||
@@ -1 +0,0 @@
|
||||
* Further improved performance on database migration from 4.66 and earlier for instances with large macOS host counts.
|
||||
@@ -1 +0,0 @@
|
||||
- Updated error message and related documentation for Windows MDM configuration.
|
||||
@@ -1 +0,0 @@
|
||||
- Updated verification of Windows Wireless profiles to avoid resending already-applied profiles
|
||||
@@ -1 +0,0 @@
|
||||
- Added support for fleet maintained apps in gitops
|
||||
@@ -1 +0,0 @@
|
||||
* Added ability to add FMA via fleetctl YAML files
|
||||
@@ -1 +0,0 @@
|
||||
In macOS MDM setup experience, added macos_setup.manual_agent_install option to bypass fleetd install. Instead, fleetd should be installed via customer-customized bootstrap package.
|
||||
@@ -1 +0,0 @@
|
||||
Fleet-managed NDES certificates will be renewed 30 days before expiry for those valid longer than 30 days or when half the validity period remains for certificates valid 30 days or less. This only applies to certificates that were requested after this renewal feature was added. For hosts with NDES certificates requested prior to this renew feature, updating the profile to contain the $FLEET_VAR_SCEP_RENEWAL_ID variable in the CN and then manually resending the profile will generate a new certificate which will be automatically renewed before its next expiry.
|
||||
@@ -1 +0,0 @@
|
||||
- Changed LUKS escrow instrucitons
|
||||
@@ -1 +0,0 @@
|
||||
Fixed `fleetctl gitops` issue where creating a new team containing VPP apps caused an error.
|
||||
@@ -1 +0,0 @@
|
||||
- Updated the parser used when editing SQL in the UI to handle modern expressions like window functions
|
||||
@@ -1 +0,0 @@
|
||||
Fleet-managed DigiCert certificates will be renewed 30 days before expiry for those valid longer than 30 days or when half the validity period remains for certificates valid 30 days or less. This only applies to certificates that were initially requested after this feature was added. For hosts with DigiCert certificates originally requested prior to this renew feature, manually resending the profile will generate a new certificate which will be automatically renewed before its next expiry.
|
||||
@@ -1 +0,0 @@
|
||||
- Added the ability to upload and install tarball archives (.tar.gz)
|
||||
@@ -1 +0,0 @@
|
||||
* Added CVE ID as matching criteria for host software queries, in addition to software name. Also rebuild host software querying for better maintainability.
|
||||
@@ -1 +0,0 @@
|
||||
Host certificates with serial numbers below 2^63 will display the decimal represntation of the serial number in addition to hex so that it is easier to match them up to what is displayed in the macOS keychain.
|
||||
@@ -1 +0,0 @@
|
||||
- Fix a small bug with the way live policy result percentages were being rounded
|
||||
@@ -1 +0,0 @@
|
||||
- Added query ID to query automation logs
|
||||
@@ -1 +0,0 @@
|
||||
- Added webhook query automation logging
|
||||
@@ -1 +0,0 @@
|
||||
- Updated Apple MDM enrollment flow to improve device-to-user mapping.
|
||||
@@ -1 +0,0 @@
|
||||
* Update Google Calendar event bodies and relevant previews in the Fleet UI
|
||||
@@ -1 +0,0 @@
|
||||
- Added shell and Powershell syntax highlighting when editing scripts
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed an issue where selections made on the Queries page were cleared a few seconds after page load.
|
||||
@@ -1 +0,0 @@
|
||||
- Added "generate-gitops" command to fleetctl
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed an issue with the gitops command caused when trying to interpolate variables inside the 'description'/'remediation' sections.
|
||||
@@ -1 +0,0 @@
|
||||
Windows hosts which re-enroll as another OS such as Linux will no longer show Windows MDM information on the hosts page unless they later re-enroll as a Windows host again(i.e. when dual booting).
|
||||
@@ -1,3 +0,0 @@
|
||||
- Fixed issue where the host expiry window caused MDM devices assigned to Fleet in Apple Business
|
||||
Manager (ABM) to be repeatedly deleted and re-added to Fleet, which in some cases also caused the
|
||||
device to revert to the default team.
|
||||
@@ -1 +0,0 @@
|
||||
Fixed issue that when Apple device was removed/re-added to ABM, it was not getting an enrollment profile.
|
||||
@@ -1 +0,0 @@
|
||||
* Fleet UI: Added hover cursors to checkbox and radio form elements
|
||||
@@ -1 +0,0 @@
|
||||
* Allow uploading a VPP when GitOps mode is enabled
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed missing To: email header
|
||||
@@ -1 +0,0 @@
|
||||
* Added support for `FLEET_VAR_HOST_END_USER_IDP_USERNAME`, `FLEET_VAR_HOST_END_USER_IDP_USERNAME_LOCAL_PART` and `FLEET_VAR_HOST_END_USER_IDP_GROUPS` fleet variables in macOS MDM configuration profiles.
|
||||
@@ -1,2 +0,0 @@
|
||||
- Add ability to set conditional access per policy, and update host policy UI to incorporate
|
||||
conditional access data
|
||||
@@ -1 +0,0 @@
|
||||
* Fleet UI: Surfaced number of policies triggering automatic install of software in software table
|
||||
@@ -1 +0,0 @@
|
||||
* Updated "My device page" layout
|
||||
@@ -1 +0,0 @@
|
||||
- Added categorization for self-service software, including filtering on the "My device" page.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed issue where `fleetctl gitops --dry-run` would sometimes fail when creating and using labels in the same run
|
||||
@@ -1 +0,0 @@
|
||||
- Added batch script execution backend functionality
|
||||
@@ -1 +0,0 @@
|
||||
- Implement ability to run a script on a batch of hosts with a single user flow
|
||||
@@ -1 +0,0 @@
|
||||
* Add webhook as a logging configuration option
|
||||
@@ -1 +0,0 @@
|
||||
Log invalid Windows MDM SOAP message and return 400 instead of 5XX. This change helps debug Windows MDM issues.
|
||||
@@ -1 +0,0 @@
|
||||
* Clean up various empty and configured states on the settings pages
|
||||
@@ -1 +0,0 @@
|
||||
Removing Apple MDM profile validation checks for com.apple.MCX keys (dontAllowFDEDisable and dontAllowFDEEnable) due to customer feedback.
|
||||
@@ -1 +0,0 @@
|
||||
Fleet UI: Install Status correctly displays available for self-service for VPP apps
|
||||
@@ -1 +0,0 @@
|
||||
* Allowed viewing the status details for an (un)install via the "My device" page
|
||||
@@ -1 +0,0 @@
|
||||
- Added `hash_sha256` field to the response for the `GET /software/titles` API.
|
||||
@@ -1 +0,0 @@
|
||||
* Fixed spurious install/uninstall script errors on EXE software edits when install and uninstall scripts were specified.
|
||||
@@ -1 +0,0 @@
|
||||
Fleet-managed Custom SCEP CA certificates will be renewed 30 days before expiry for those valid longer than 30 days or when half the validity period remains for certificates valid 30 days or less. This only applies to certificates that were requested after this renewal feature was added. For hosts with Custom SCEP CA certificates requested prior to this renew feature, updating the profile to contain the $FLEET_VAR_SCEP_RENEWAL_ID variable in the CN and then manually resending the profile will generate a new certificate which will be automatically renewed before its next expiry.
|
||||
@@ -1 +0,0 @@
|
||||
- Show the premium feature message when viewing the GitOps mode toggle page on Fleet free
|
||||
@@ -1 +0,0 @@
|
||||
* Enable saving Integrations > Advanced in GitOps mode
|
||||
@@ -1,2 +0,0 @@
|
||||
- Fixed bug where Fleet failed to restore some "pending" hosts (i.e. hosts that remained assigned to
|
||||
Fleet in Apple Business Manager) when multiple hosts are deleted from Fleet.
|
||||
@@ -1 +0,0 @@
|
||||
- Fixed issue where GitOps may fail to apply new queries due to deadlocks.
|
||||
@@ -1 +0,0 @@
|
||||
- Added an additional statistic item to count ABM pending hosts.
|
||||
@@ -1 +0,0 @@
|
||||
- add UI for the manual agent install of a bootstrap package
|
||||
@@ -1 +0,0 @@
|
||||
- remove fleet config no team settings when the no-team.yml file is removed via gitops
|
||||
@@ -1 +0,0 @@
|
||||
- add keyboard accessibility controls to activities on dashboard and host details pages
|
||||
@@ -1 +0,0 @@
|
||||
- add truncation and a conditional tooltip for long host names on the host details page
|
||||
@@ -1,2 +0,0 @@
|
||||
- fix an issue where the upcoming host activities showed the incorrect created at date in the
|
||||
tooltip
|
||||
@@ -1 +0,0 @@
|
||||
* Updated go to 1.24.2.
|
||||
@@ -4,11 +4,11 @@ name: fleet
|
||||
keywords:
|
||||
- fleet
|
||||
- osquery
|
||||
version: v6.6.1
|
||||
version: v6.6.2
|
||||
home: https://github.com/fleetdm/fleet
|
||||
sources:
|
||||
- https://github.com/fleetdm/fleet.git
|
||||
appVersion: v4.67.3
|
||||
appVersion: v4.68.0
|
||||
dependencies:
|
||||
- name: mysql
|
||||
condition: mysql.enabled
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
hostName: fleet.localhost
|
||||
replicas: 3 # The number of Fleet instances to deploy
|
||||
imageRepository: fleetdm/fleet
|
||||
imageTag: v4.67.3 # Version of Fleet to deploy
|
||||
imageTag: v4.68.0 # Version of Fleet to deploy
|
||||
# imagePullSecrets is optional.
|
||||
# imagePullSecrets:
|
||||
# - name: docker
|
||||
|
||||
@@ -56,7 +56,7 @@ variable "database_name" {
|
||||
|
||||
variable "fleet_image" {
|
||||
description = "the name of the container image to run"
|
||||
default = "fleetdm/fleet:v4.67.3"
|
||||
default = "fleetdm/fleet:v4.68.0"
|
||||
|
||||
variable "software_inventory" {
|
||||
description = "enable/disable software inventory (default is enabled)"
|
||||
|
||||
@@ -68,8 +68,7 @@ variable "redis_mem" {
|
||||
}
|
||||
|
||||
variable "image" {
|
||||
default = "fleetdm/fleet:v4.67.3"
|
||||
}
|
||||
default = "fleetdm/fleet:v4.68.0"
|
||||
|
||||
variable "software_installers_bucket_name" {
|
||||
default = "fleet-software-installers"
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "fleetctl",
|
||||
"version": "v4.67.3",
|
||||
"version": "v4.68.0",
|
||||
"description": "Installer for the fleetctl CLI tool",
|
||||
"bin": {
|
||||
"fleetctl": "./run.js"
|
||||
|
||||
@@ -318,20 +318,22 @@ build_changelog() {
|
||||
api_endpoint="https://api.openai.com/v1/chat/completions"
|
||||
output="null"
|
||||
|
||||
while [[ "$output" == "null" ]]; do
|
||||
data_payload=$(jq -n \
|
||||
--arg prompt "$question" \
|
||||
--arg model "gpt-3.5-turbo" \
|
||||
'{model: $model, messages: [{"role": "user", "content": $prompt}]}')
|
||||
# while [[ "$output" == "null" ]]; do
|
||||
# data_payload=$(jq -n \
|
||||
# --arg prompt "$question" \
|
||||
# --arg model "gpt-4o" \
|
||||
# '{model: $model, messages: [{"role": "user", "content": $prompt}]}')
|
||||
|
||||
response=$(curl -s -X POST $api_endpoint \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Authorization: Bearer $open_api_key" \
|
||||
--data "$data_payload")
|
||||
# response=$(curl -s -X POST $api_endpoint \
|
||||
# -H "Content-Type: application/json" \
|
||||
# -H "Authorization: Bearer $open_api_key" \
|
||||
# --data "$data_payload")
|
||||
|
||||
output=$(echo $response | jq -r .choices[0].message.content)
|
||||
echo "${output}"
|
||||
done
|
||||
# echo "${response}"
|
||||
|
||||
# output=$(echo $response | jq -r .choices[0].message.content)
|
||||
# echo "${output}"
|
||||
# done
|
||||
|
||||
git checkout CHANGELOG.md
|
||||
if [[ "$target_date" == "" ]]; then
|
||||
@@ -772,7 +774,7 @@ if [ "$cherry_pick_resolved" = "false" ]; then
|
||||
prs_for_issue=$(gh api repos/fleetdm/fleet/issues/$issue/timeline --paginate | jq -r '.[]' | $GREP_CMD "fleetdm/fleet/" | $GREP_CMD -oP "pulls\/\K(?:\d+)")
|
||||
echo -n "https://github.com/fleetdm/fleet/issues/$issue"
|
||||
if [[ "$prs_for_issue" == "" ]]; then
|
||||
echo -n " - No PRs found, please verify they are not missing in the issue."
|
||||
echo -n " - No PRs found."
|
||||
fi
|
||||
for val in $prs_for_issue; do
|
||||
echo -n " $val"
|
||||
|
||||
Reference in New Issue
Block a user